CVE-2026-33721: mapserver Out-of-bounds Write
Vulnerability summary
CVE-2026-33721 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in mapserver. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 17-04-2026Last modifiedVulnerability information updated.
Description
MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with more than 100 Threshold elements inside a ColorMap/Categorize structure (commonly reachable via WMS GetMap with SLD_BODY). Version 8.6.1 patches the issue.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.82%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
-0.05 pp
From 0.86% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMapserver
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- mapserver< 8.0.0-3+deb12u1 | < 8.4.0-4+deb13u2 | < 8.6.1-1
Mapserver1 product
- mapserver≥ 4.2, < 8.6.1
Opensuse1 product
- mapserver&distro=openSUSE Tumbleweed< 8.6.1-1.1
Osgeo1 product
- mapserver≥ 4.2.0, < 8.6.1
Ubuntu1 product
- mapserverAll versions (No fix recorded)
5 vendors · 5 products
References
7 links- github.com/MapServer/MapServer/security/advisories/GHSA-cv4m-mr84-fgjpX Refsource CONFIRMREPORTExploitMitigationVendor Advisory
